Data insight scoring for performance analytics

ABSTRACT

An enterprise management platform is configured to host a respective instance for multiple client networks. The enterprise management platform receives incoming data including one or more metrics being tracked in the incoming data by the enterprise management platform. For each metric of the one or more metrics, a determination is made that a statistic generator is to be processed for the corresponding metric, and responsive to determining that the statistic generator is to be processed, a statistic is generated using the statistic generator. For each statistic, a news score is generated, using a news evaluator, to convert the statistic generator to a news score. The news scores are then sorted and stored in a database disposed within the enterprise management platform.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of Provisional Application Ser. No.62/568,087, filed Oct. 4, 2017, entitled “PLATFORM COMPUTING ENVIRONMENTAND FUNCTIONALITY THEREOF,” which is incorporated by reference herein inits entirety.

BACKGROUND

This section is intended to introduce the reader to various aspects ofart that may be related to aspects of the present disclosure, which aredescribed and/or claimed below. This discussion is believed to behelpful in providing the reader with background information tofacilitate a better understanding of the various aspects of the presentdisclosure. Accordingly, it should be understood that these statementsare to be read in this light, and not as admissions of prior art.

Computer resources hosted in distributed computing (e.g.,cloud-computing) environments may be disparately located with differentresources potentially having their own functions, properties, and/orpermissions. Such resources may include hardware resources (e.g.computing devices, switches, etc.) and software resources (e.g. databaseapplications). These resources may be used to collect and store data atvarious times related to a variety of measurable properties, includingnetwork, hardware, or database performance properties measured atdifferent times. As systems for collecting data become more readilyavailable and the costs for storage hardware continue to decrease, theamount of data that these computer resources are capable of collectingis increasing. For instance, in addition to collecting raw data morefrequently, metadata associated with the time in which the raw data hasbeen generated or acquired may also be stored for a given data set.

Although the capabilities of computer resources for collecting andstoring data continue to expand, the vast amount of collected data hasresulted in difficulties with analysis and reporting of theever-increasing multitude of data.

SUMMARY

A summary of certain embodiments disclosed herein is set forth below. Itshould be understood that these aspects are presented merely to providethe reader with a brief summary of these certain embodiments and thatthese aspects are not intended to limit the scope of this disclosure.Indeed, this disclosure may encompass a variety of aspects that may notbe set forth below.

Information Technology (IT) networks may include a number of computingdevices, server systems, databases, and the like that generate, collect,and store information. As increasing amounts of data representingresources become available, it becomes increasingly difficult to analyzethe data, interact with the data, and/or provide reports for the data.The current embodiments enable customized analysis of such data andidentifies and provides insights about the potentially massive amount ofdata without presenting items that are less notable. As discussed,herein this data may be sorted according to notability or“newsworthiness.” The notability of various metrics or indicators mayinclude raw numbers (e.g., number of open incidents), generated from rawnumber using transfer functions, weighted manually by users, or anycombination thereof. Furthermore, in some embodiments, the insights mayinclude predictive forecasting based on the data.

Various refinements of the features noted above may exist in relation tovarious aspects of the present disclosure. Further features may also beincorporated in these various aspects as well. These refinements andadditional features may exist individually or in any combination. Forinstance, various features discussed below in relation to one or more ofthe illustrated embodiments may be incorporated into any of theabove-described aspects of the present disclosure alone or in anycombination. The brief summary presented above is intended only tofamiliarize the reader with certain aspects and contexts of embodimentsof the present disclosure without limitation to the claimed subjectmatter.

BRIEF DESCRIPTION OF THE DRAWINGS

The description herein makes reference to the accompanying drawings,wherein like reference numerals refer to like parts throughout theseveral views.

FIG. 1 is a block diagram of a distributed computing system, inaccordance with an embodiment;

FIG. 2 is a schematic of an embodiment of a multi-instance architecture150 that may be utilized by the distributed computing system of FIG. 1,in accordance with an embodiment;

FIG. 3 is a block diagram of a computing device utilized in thedistributed computing system of FIG. 1, in accordance with anembodiment;

FIG. 4 is a block diagram illustrating performance analytics andreporting (PAR) features facilitated through a dashboard for thedistributed computing system of FIG. 1, in accordance with anembodiment;

FIG. 5 is an illustration of a graphical user interface (GUI) 500illustrating a blank canvas 502 where widgets may be placed in thedashboard of FIG. 4, in accordance with an embodiment;

FIG. 6 is an illustration of a GUI with a “New Report” widget beingdragged and dropped to the canvas of FIG. 5, in accordance with anembodiment;

FIG. 7 is an illustration of a GUI presenting dynamically resized andpositioned widgets in the dashboard of FIG. 4, in accordance with anembodiment;

FIG. 8 is an illustration of a GUI where a characteristic editing dialogbox is presented upon selection of the configuration option in thedashboard of FIG. 4, in accordance with an embodiment;

FIG. 9 is an illustration of a GUI of a performance analytics widgetpositioned on the dashboard of FIG. 4, in accordance with an embodiment;

FIG. 10 is an illustration of a GUI that provides a deep-dive into theperformance analytics widget of FIG. 9 based upon the selection of adata plot, in accordance with an embodiment;

FIG. 11 is an illustration of a GUI that provides a configuration menu,triggered by a configuration icon in the dashboard of FIG. 4, inaccordance with an embodiment;

FIG. 12 is an illustration of a GUI where forecast analytics aretriggered by selecting a forecast option in the dashboard of FIG. 4, inaccordance with an embodiment;

FIG. 13 is an illustration of a GUI where the configuration menu of FIG.11 is removed and showing forecasting data results from the triggeredforecast analytics, in accordance with an embodiment;

FIG. 14 is an illustration of a GUI with target prediction in thedashboard of FIG. 4, in accordance with an embodiment;

FIG. 15 is an illustration of a GUI where a target prediction box ispresented based upon a target value entered in the GUI of FIG. 14, inaccordance with an embodiment;

FIG. 16 is an illustration of a notification dialog box triggered byselecting a notification icon in the dashboard of FIG. 4, in accordancewith an embodiment;

FIG. 17 is an illustration of a GUI presented in response to selectionin the notification dialog box of FIG. 16, in accordance with anembodiment;

FIG. 18 is an illustration of a GUI that provides a more than thresholdindicator in response to selection in the notification dialog box ofFIG. 16, in accordance with an embodiment;

FIG. 19 is an illustration of a GUI showing a data insights widget inthe dashboard of FIG. 4, in accordance with an embodiment;

FIG. 20 is an alternative illustration of a GUI showing a data insightswidget in the dashboard of FIG. 4, in accordance with an embodiment;

FIG. 21 is a flow diagram of a process for implementing the datainsights widget of FIGS. 19 and 20, in accordance with an embodiment;

FIG. 22 is a flow diagram of a process for implementing the datainsights widget of FIGS. 19 and 20, in accordance with an embodiment;

FIG. 23 is a block diagram of a dynamics analytics engine including astatistics engine that may be used to combine various analytics typesfor the data insights widget of FIGS. 19 and 20, in accordance with anembodiment;

FIG. 24 is a block diagram of databases, including a rules database,that may be used in the statistics engine of FIG. 23, in accordance withan embodiment;

FIG. 25 is an illustration of a GUI that may be used to add/view/changeentries in the rules database of FIG. 24, in accordance with anembodiment;

FIG. 26 is an illustration of a GUI for setting configuration detailsabout the entries of FIG. 25 including statistic generators, inaccordance with an embodiment;

FIG. 27 is an illustration of a GUI that may be used to configurestatistic generators of FIG. 26, in accordance with an embodiment;

FIG. 28 is a flow diagram of a process that may be used in generatingnews items for the data insights widget of FIGS. 19 and 20, inaccordance with an embodiment;

FIG. 29 is a flow diagram of a process that may be used to generate anddisplay news items from a news score database in response to a request,in accordance with an embodiment;

FIG. 30 is an illustration of a GUI for an application programminginterface (API) explorer that may be used to view API calls that may beused in the request of FIG. 29, in accordance with an embodiment; and

FIG. 31 is a flow diagram of a process that may be used to display newsitems, in accordance with an embodiment.

DETAILED DESCRIPTION

One or more specific embodiments will be described below. In an effortto provide a concise description of these embodiments, not all featuresof an actual implementation are described in the specification. Itshould be appreciated that in the development of any such actualimplementation, as in any engineering or design project, numerousimplementation-specific decisions must be made to achieve thedevelopers' specific goals, such as compliance with system-related andenterprise-related constraints, which may vary from one implementationto another. Moreover, it should be appreciated that such a developmenteffort might be complex and time consuming, but would nevertheless be aroutine undertaking of design, fabrication, and manufacture for those ofordinary skill having the benefit of this disclosure.

The following discussion relates to analysis, forecasting, and reportingsystems for Information Technology (IT) systems. However, this is notmeant to limit the current techniques to IT systems. Indeed, the currenttechniques may be useful in a number of different contexts. For examplethe current techniques may be applied to Human Resources (HR) systems orany system that may benefit from the analysis, forecasting, andreporting of data.

Keeping this in mind, the discussion now turns to an InformationTechnology (IT)-centered example. IT devices are increasingly importantin a world in which various electronics devices are interconnectedwithin a distributed context. As more functions are performed byservices using some form of distributed computing, the complexity of ITnetwork management increases. As management complexities increase, dataanalysis, forecasting, and reporting may become more complex.

By way of introduction to the present concepts and to provide contextfor the examples discussed herein, FIG. 1 is a block diagram of a system100 that utilizes a distributed computing framework, which may performone or more of the techniques described herein. As discussed below inrelation to FIG. 2, the system 100 may include or support amultiple-instance architecture. As illustrated in FIG. 1, a client 102communicates with a platform 104, such as a cloud service platform, overa communication channel 106. The client 102 may include any suitablecomputing system. For instance, the client 102 may include one or morecomputing devices, such as a mobile phone, a tablet computer, a laptopcomputer, a notebook computer, a desktop computer, or any other suitablecomputing device or combination of computing devices. The client 102 mayinclude client application programs running on the computing devices.The client 102 can be implemented using a single physical unit or acombination of physical units (e.g., distributed computing) running oneor more client application programs. Furthermore, in some embodiments, asingle physical unit (e.g., server) may run multiple client applicationprograms simultaneously.

The platform 104 may include any suitable number of computing devices(e.g., computers) in one or more locations that are connected togetherusing one or more networks. For instance, the platform 104 may includevarious computers acting as servers in datacenters at one or moregeographic locations where the computers communicate using networkand/or Internet connections. The communication channel 106 may includeany suitable communication mechanism for electronic communicationbetween the client 102 and the platform 104. The communication channel106 may incorporate local area networks (LANs), wide area networks(WANs), virtual private networks (VPNs), cellular networks (e.g., longterm evolution networks), and/or other network types for transferringdata between the client 102 and the platform 104. For example, thecommunication channel 106 may include an Internet connection when theclient 102 is not on a local network common with the platform 104.Additionally or alternatively, the communication channel 106 may includeinter-network connections when the client and the platform 104 are ondifferent networks or entirely using intra-network connections when theclient 102 and the platform 104 share a common network. Although only asingle client 102 is shown connected to the platform 104, it should benoted that platform 104 may connect to multiple clients (e.g., tens,hundreds, or thousands of clients).

Through the platform 104, here a cloud service type-platform, the client102 may connect to various devices with various functionality, such asgateways, routers, load balancers, databases, application serversrunning application programs on one or more nodes, or other devices thatmay be accessed via the platform 104. For example, the client 102 mayconnect to an application server 107 and/or one or more databases 108via the platform 104. The application server 107 may include anycomputing system, such as a desktop computer, laptop computer, servercomputer, and/or any other computing device capable of providingfunctionality from an application program to the client 102. Theapplication server 107 may include one or more application nodes runningapplication programs whose functionality is provided to the client 102via the platform 104. The application nodes may be implemented usingprocessing threads, virtual machine instantiations, or other computingfeatures of the application server 107. Moreover, the application nodesmay store, evaluate, or retrieve data from the databases 108 and/or adatabase server.

In some embodiments, the databases 108 may contain a series of tablescontaining information about assets and enterprise services controlledby the client 102 and the configurations of these assets and services.The assets and services include configuration items (CIs) 110 that maybe computers, other devices on a network 112 (or group of networks),software contracts and/or licenses, or enterprise services. In someembodiments, the client 102 may be associated with and/or located withinthe network 112. The CIs 110 may include hardware resources (such asserver computing devices, client computing devices, processors, memory,storage devices, networking devices, or power supplies); softwareresources (such as instructions executable by the hardware resourcesincluding application software or firmware); virtual resources (such asvirtual machines or virtual storage devices); and/or storage constructs(such as data files, data directories, or storage models). As such, theCIs 110 may include a combination of physical resources or virtualresources. For example, the illustrated embodiment of the CIs 110includes printers 114, routers/switches 116, load balancers 118, virtualsystems 120, storage devices 122, and/or other connected devices 124.The other connected devices 124 may include clusters of connectedcomputing devices or functions such as data centers, computer rooms,databases, or other suitable devices. Additionally or alternatively, theconnected devices 124 may include facility-controlling devices havingaspects that are accessible via network communication, such as heating,ventilation, and air conditioning (HVAC) units, fuel tanks, powerequipment, and the like. The databases 108 may include informationrelated to CIs 110, attributes (e.g., roles, characteristics ofelements, etc.) associated with the CIs 110, and/or relationshipsbetween the CIs 110.

In some embodiments, the databases 108 may include a configurationmanagement database (CMDB) that may store the data concerning CIs 110mentioned above along with data related to various IT assets that may bepresent within the network 112. In addition to the databases 108, theplatform 104 may include one or more other database servers. Thedatabase servers are configured to store, manage, or otherwise providedata for delivering services to the client 102 over the communicationchannel 106. The database server may include one or more additionaldatabases that are accessible by the application server 107, the client102, and/or other devices external to the additional databases. By wayof example, the additional databases may include a relational databaseand/or a time series database. The additional databases may beimplemented and/or managed using any suitable implementations, such as arelational database management system (RDBMS), a time series databasemanagement system, an object database, an extensible markup language(XML) database, a configuration management database (CMDB), a managementinformation base (MIB), one or more flat files, and/or or other suitablenon-transient storage structures. In some embodiments, more than asingle database server may be utilized. Furthermore, in someembodiments, the platform 104 may have access to one or more databasesexternal to the platform 104 entirely.

In the depicted topology, access to the CIs 110 from the platform 104 isenabled via a management, instrumentation, and discovery (MID) server126 via a communication queue 128, such as an External CommunicationsChannel Queue. However, in some embodiments, at least a portion of theCIs 110 may directly couple to the platform 104. The MID server 126 mayinclude an application program (e.g., Java application) that runs as aservice (e.g., Windows service or UNIX daemon) that facilitatescommunication and movement of data between the platform 104 and externalapplications, data sources, and/or services. The MID server 126 may beimplemented using a computing device (e.g., server or computer) on thenetwork 112 that communicates with the platform 104. The MID server 126may periodically or intermittently use discovery probes to determineinformation on devices connected to the network 112 and return the proberesults back to the platform 104. In the illustrated embodiment, the MIDserver 126 is located inside the network 112 thereby alleviating the useof a firewall in communication between the CIs 110 and the MID server126. However, in some embodiments, a secure tunnel may be generatedbetween a MID server 126 running in the platform 104 that communicateswith a border gateway device of the network 112.

The communication channel 128 may be a database table that is typicallyqueried, updated, and inserted into by other systems. Each record in thecommunication channel 128 is a message from an instance in the platform104 to a system (e.g., MID server 126) external to the platform 104 thatconnects to the platform 104 or a specific instance 130 running in theplatform 104 or a message to the instance from the external system. Thefields of a communication channel 128 record include various data aboutthe external system or the message in the record.

Although the system 100 is described as having the application servers107, the databases 108, the communication channel 128, the MID server126, and the like, it should be noted that the embodiments disclosedherein are not limited to the components described as being part of thesystem 100. Indeed, the components depicted in FIG. 1 are merelyprovided as example components and the system 100 should not be limitedto the components described herein. Instead, it should be noted thatother types of server systems (or computer systems in general) maycommunicate with the platform 104 in addition to the MID server 126and/or may be used to implement the present approach.

Further, it should be noted that server systems described herein maycommunicate with each other via a number of suitable communicationprotocols, such as via wired communication networks, wirelesscommunication networks, and the like. In the same manner, the client 102may communicate with a number of server systems via a suitablecommunication network without interfacing its communication via theplatform 104.

In addition, other methods for populating the databases 108 may includedirectly importing the CIs or other entries from an external source,manual import by users entering CIs or other entries via a userinterface, and the like. Moreover, although the details discussed aboveare provided with reference to the CMDB, it should be understood thatthe embodiments described herein should not be limited to beingperformed with the CMDB. Instead, the present systems and techniquesdescribed herein may be implemented with any suitable database.

In any case, the application servers 107 and/or the databases 108 maystore content accessible by one or more users via one or more of theclients 102. For example, the application server 107 may store one ormore pages with which one or more of the users may interact (e.g., view,post, etc.) with other users and/or customer service agents. As aresult, users may use the pages to track and/or resolve issues thatarise through installation, expansion, maintenance, and regular use ofthe network, either on their own, or with the help of a customer serviceagent. Furthermore, the pages may be used to display key performanceindicators of functions (e.g., ticket resolution for open items for thecustomer service agent) implemented using the application programs ofthe application servers 107.

FIG. 2 is a schematic of an embodiment of a multi-instance architecture150 that may be utilized by the system 100 of FIG. 1. As shown, the oneor more clients 102 are connected to a customer network 152, which mayor may not be protected by a firewall 154. The one or more clients 102may access first and second virtual machines 158, 160 via the Internet156. In the illustrated embodiment, the first virtual machine 158 is aprimary virtual machine 158 and the second virtual machine 160 is asecondary virtual machine. The primary and secondary virtual machines158, 160 are disposed in different data centers. Other embodiments mayinclude more than two virtual machines (e.g., multiple secondary virtualmachines). As shown, each of the virtual machines 158, 160 includes atleast one load balancer 162, multiple application nodes 164, and adatabase 108. In the illustrated embodiment, the database 108A of theprimary virtual machine 158 is a read-write database, and the database108B of the secondary virtual machine 160 is a read-only database. Thedatabases 108 may be replicated via MySQL binlog replication fornear-real-time replication between the primary database 108A and thesecondary database 108B. As shown, the application nodes 164A of theprimary virtual machine 158 may access the primary database 108A, whilethe applications nodes 164B of the secondary virtual machine 160 mayaccess both the primary database 108A and the secondary database 108B.

Each customer may have its own dedicated virtual machines 158, 160 anddatabase processes. Further, full and incremental backups may bescheduled as the customer wishes (e.g., daily, weekly, bi-weekly,monthly, etc.). The multi-instance architecture 150 results in fullinstance redundancy for all production instances with near-real-timereplication and no comingling of data between customers. By providingcustomers with their own database(s) 108, customers are isolated fromdatabase maintenance and/or database failure of other customers.Further, maintenance and repair windows are shorter. In someembodiments, a client 102 may pull data from multiple differentdatabases 108 distributed over multiple virtual machines 158, 160 and/ordata centers. The pulled data may then be combined and used as inputs toperform a task, such as tracking key performance indicators for thevarious instances.

In any case, to perform one or more of the operations described herein,the client 102, the application server 107, the MID server 126, andother servers or computing systems described herein may include one ormore of the computer components depicted in FIG. 3. FIG. 3 generallyillustrates a block diagram of example components of a computing device200 and their potential interconnections or communication paths, such asalong one or more busses. As briefly mentioned above, the computingdevice 200 may be an embodiment of the client 102, the applicationserver 107, a database server (e.g., databases 108), other servers orprocessor-based hardware devices present in the platform 104 (e.g.,server hosting the communication channel 128), a device running the MIDserver 126, and/or any of the CIs. As previously noted, these devicesmay include a computing system that includes multiple computing devicesand/or a single computing device, such as a mobile phone, a tabletcomputer, a laptop computer, a notebook computer, a desktop computer, aserver computer, and/or other suitable computing devices.

As illustrated, the computing device 200 may include various hardwarecomponents. For example, the device includes one or more processors 202,one or more busses 204, memory 206, input structures 208, a power source210, a network interface 212, a user interface 214, and/or othercomputer components useful in performing the functions described herein.

The one or more processors 202 may include processors capable ofperforming instructions stored in the memory 206. For example, the oneor more processors may include microprocessors, system on a chips(SoCs), or any other suitable circuitry for performing functions byexecuting instructions stored in the memory 206. Additionally oralternatively, the one or more processors 202 may includeapplication-specific integrated circuits (ASICs), field-programmablegate arrays (FPGAs), and/or other devices designed to perform some orall of the functions discussed herein without calling instructions fromthe memory 206. Moreover, the functions of the one or more processors202 may be distributed across multiple processors in a single physicaldevice or in multiple processors in more than one physical device. Theone or more processors 202 may also include specialized processors, suchas a graphics processing unit (GPU).

The one or more busses 204 includes suitable electrical channels toprovide data and/or power between the various components of thecomputing device. For example, the one or more busses 204 may include apower bus from the power source 210 to the various components of thecomputing device. Additionally, in some embodiments, the one or morebusses 204 may include a dedicated bus among the one or more processors202 and/or the memory 206.

The memory 206 may include any tangible, non-transitory, andcomputer-readable storage media. For example, the memory 206 may includevolatile memory, non-volatile memory, or any combination thereof. Forinstance, the memory 206 may include read-only memory (ROM), randomlyaccessible memory (RAM), disk drives, solid state drives, external flashmemory, or any combination thereof. Although shown as a single block inFIG. 2, the memory 206 can be implemented using multiple physical unitsin one or more physical locations. The one or more processor 202accesses data in the memory 206 via the one or more busses 204.

The input structures 208 provide structures to input data and/orcommands to the one or more processor 202. For example, the inputstructures 208 include a positional input device, such as a mouse,touchpad, touchscreen, and/or the like. The input structures 208 mayalso include a manual input, such as a keyboard and the like. Theseinput structures 208 may be used to input data and/or commands to theone or more processors 202 via the one or more busses 204. The inputstructures 208 may alternative or additionally include other inputdevices. The input structures 208 may also monitor operating conditions(e.g., temperatures) of various components of the computing device 200,such as the one or more processors 202.

The power source 210 can be any suitable source for power of the variouscomponents of the computing device 200. For example, the power source210 may include line power and/or a battery source to provide power tothe various components of the computing device 200 via the one or morebusses 204.

The network interface 212 is also coupled to the processor 202 via theone or more busses 204. The network interface 212 includes one or moretransceivers capable of communicating with other devices over one ormore networks (e.g., the communication channel 106). The networkinterface may provide a wired network interface, such as Ethernet, or awireless network interface, such an 802.11, Bluetooth, cellular (e.g.,LTE), or other wireless connections. Moreover, the computing device 200may communicate with other devices via the network interface 212 usingone or more network protocols, such as Transmission ControlProtocol/Internet Protocol (TCP/IP), power line communication (PLC),Wi-Fi, infrared, and/or other suitable protocols.

A user interface 214 may include a display that is configured to displayimages transferred to it from the one or more processors 202. Inaddition and/or alternative to the display, the user interface 214 mayinclude other devices for interfacing with a user. For example, the userinterface 214 may include lights (e.g., LEDs), speakers, and the like.

Display Widgets

The discussion now turns to a mechanism for displaying system data,enabling interactivity with the system data, and reporting on the systemdata. As may be appreciated, such system data may be relevant to asystem in a platform environment as described with respect to FIG. 1 aswell as to system in a multi-instance architecture as described withrespect to FIG. 2. FIG. 4 is a block diagram illustrating performanceanalytics and reporting (PAR) features facilitated through a dashboard304, in accordance with an embodiment. As used herein, a “dashboard”refers to a graphical-user-interface (GUI) screen where data-drivenwidgets 306 and/or other widgets may be dynamically presented. Thewidgets 306 may include independent data-driven software that performparticular tasks. For example, the widgets 306 may providevisualizations generated from/based upon datasets of the system. Forinstance, the widgets 306 may provide data insights that indicateheadlines portraying “news” relevant to one or more indicator types ofdata being tracked. For example, the indicator types may include anumber of open incidents, a number of resolved problems, percentage ofincidents resolved by a specific assigned group, a percentage of newcritical incidents relative to a total number of new incidents, apercentage of open incidents that have not been updated in a certaintime period (e.g., days, weeks, or months), average age of last updateof open incidents, average age of open incidents, average re-assignmentof open incidents, average resolution time of resolved incidents, growthof an incident backlog, number of new incidents, number of openincidents, number of open incidents not updated in a certain time period(e.g., days, weeks, or months), number of resolved incidents, datareflecting statuses (e.g., online, offline, busy, idle, error modes) ofthe CIs 110, and/or any user-defined statistics that may be tracked inthe PAR features on dashboard 304.

In some embodiments, the widgets 306 placed on the screen may beconstrained to pre-defined containers with or without static locationsand/or static sizes. In other words, in some embodiments, for dashboard304, the widgets 306 may be dynamically moved to any location on thedashboard 304 without being constrained to pre-defined locations, asindicated by arrows 310. Further, the size of the widgets 306 may bedynamically altered in the dashboard 304, as indicated by the sizingindicators 312 and the arrows 314.

As previously noted, the widgets 306 may include independent data-drivensoftware that perform particular tasks, such as visualizations generatedfrom datasets of the system. These widgets 306 may be selectable to beadded to the dashboard 304. For example, in some embodiments, adashboard 304 may allow widgets 306 to be dragged and dropped into anylocation within a canvas of a dashboard 304. Further, as previouslynoted, the widgets 306 may be dynamically sized and re-arranged. Turningto a discussion of the dynamic widget positioning and resizing, FIG. 5is an illustration of a graphical user interface (GUI) 500 illustratinga blank canvas 502 where widgets 306 may be placed. In some embodiments,the widgets 306 may be added to the GUI 500 using an add widget sidebar504. In such embodiments, a dropdown list 506 may provide a list ofavailable widgets that may be added to the dashboard 304. In FIG. 5, theblank canvas 502 is formed on a tab 508. A dialog box (e.g., the AddWidget sidebar 504) may be provided, such that a widget 306 may beselected from the dropdown list 506 and placed in the canvas 502 (e.g.,via drag and drop). For example, in FIG. 6, a GUI 600 illustrates a “NewReport” widget 602 being dragged and dropped to a canvas 604.

FIG. 7 illustrates a GUI 700 presenting dynamically resized andpositioned widgets 306. In addition, in some embodiments, when a hoverover occurs on one of the widgets 306, a dialog box 702 may appear. Thedialog box 702 may include a configuration option 704, which may be usedto edit characteristics of the widget 306. For example, FIG. 8illustrates a GUI 800 where a characteristic editing dialog box 702 ispresented upon selection of the configuration option 1406. Thecharacteristic editing dialog box 802 may include a border option 804 toselectively turn a border for the widget 306 on or off. Further, a titleoption 806 may selectively turn a title presentation for the widget 306on or off. A title align option 808 may selectively determine whetherthe title of the widget 306 is left justified, right justified, orcentered. A priority option 810 may be used to select whether a prioritylist is applied for the widget 306. For example, the widget 306 maypresent key performance indicators, and the priority option 810 may beused to prioritize the indicators in the widget 306 for an organizeddisplay. An interactivity option 814 selectively enables an interactivefilter, which may filter some of the data from the report visualized bythe widget 306, as will be discussed in more detail below.

Performance Analytics Widget

As previously noted, the widget 306 may include a performance analyticswidget. For example, FIG. 9 is an illustration of a GUI 900 of aperformance analytics widget 902 positioned on the dashboard 304, inaccordance with an embodiment. The performance analytics widget 902provides a visualization of key performance indicators (KPIs) andmetrics. In the currently illustrated embodiment, two data plots 904 and906 are provided. Data plot 904 provides an indication of a percentageof open incidents (X-axis) over a period of time ranging from the last30 days (Y-axis). Additionally, a trend 908 is defined and presentedbased upon the data 910 in the data plot 904. The data plot 906 includesdata 912 indicating a percentage of incidents resolved by a firstassignment group (X-axis) over a period of time (Y-axis). Further, atrend 914 is defined and presented based upon the data 912 in the dataplot 906.

When one of the plots 904 and/or 906 is selected, the GUI 900 maytransition to a larger view of the data with additional options. FIG. 10is an illustration of a GUI 1000 that provides a deep-dive into theperformance analytics widget 902 of FIG. 9, based upon the selection ofthe data plot 904, in accordance with an embodiment. The title 1002illustrates the title of the data plot 904 of FIG. 9. Further, a rangeselector 1004 enables selection of a new range for the data 910. The GUI1000 also includes a change indicator 1006 that indicates the change(e.g., percentage change) corresponding to the indicator of the title1002. Furthermore, a directional change indicator 1008 indicates adirection of change. Here, since a percentage of open incidents is anegative condition a positive change in the percentage is a negativecondition. Accordingly, the directional change indicator 1008 includes adownward arrow indicating a negative change in condition even when thechange in percentage of open incidents has increased. In other words,the directional change indicator 1008 enables a quick identification ofwhether the condition corresponding to the data plot 904 is improving orworsening. Furthermore, the directional change indicator 1008 and/or thechange indicator 1006 may include a color indicating whether thecondition is improving (e.g., green) or worsening (e.g., red).

The GUI 1000 may also include a navigation bar 1010 that includes achart button 1012, a breakdown button 1014, a scores button 1016, acomments button 1018, and more info button 1020. The chart button 1012may be selected to cause a chart of the data 910 to be displayed in theGUI 1000. The breakdown button 1014 may be used to view variousbreakdowns of the data 910. The scores button 1016 may be used to viewraw numbers of the measurement corresponding to the indicator type. Thecomments button 1018 may be used to view/edit/change comments related tothe indicator type. The more info button 1020 may be used to viewadditional information about the indicator type and/or the data 910.

Additional options may be selectable. For example, in FIG. 11, the GUI1100 provides a configuration menu 1102, triggered by a configurationicon 1104. As illustrated, the trend visualization (e.g., the trend 908)may be selectively turned on or off using a trend option 1106.Forecasting (e.g., predicting future data) may be selectively turned onor off using a forecast option 1108. Other options, such asvisualization of a confidence band, labels, and/or statistics may alsobe selectively turned on or off. Further, the chart type may be changedfrom a line chart to other forms of charts (e.g., bar chart) using thechart type option 1110. In GUI 1200 of FIG. 12, the forecast analyticsare triggered by selecting the forecast option 1108. Then, a forecastanalytics is run and forecasting data 1202 is presented in a line chart1204.

FIG. 13 is an illustration of a GUI 1300 where the configuration menu1102 is removed, showing the forecasting data 1202 results from thetriggered forecast analytics. As illustrated, the forecasting data 1202may be differentiated from observed data in the line chart 1204. Forexample, the forecasting data 1202 may be represented differently thanthe historical data in the line chart 1204, such as by presenting theforecasting data 1202 in a different color, as a dashed line, or otherdifferentiation from the historical data in the line chart 1204. Whenpredictions are triggered, the historical data may be mined for datapatterns in the historical data. Based upon the observed patterns, thetime-series data may be classified into one of multiple classificationtypes. For example, the historical data may be classified as data havingseasonal components (i.e., certain commonalities at certain times), nearconstant data (i.e., retaining nearly the same values over time),trending data, data that switches between two or more states, and/orcategorical data (i.e., data that includes a set of discrete values).The classification may be used to analyze and estimate data forecasts.The forecasting data 1202 may be used to predict when certain targetsand/or thresholds may be met.

FIG. 14 illustrates a GUI 1400 with target prediction. Target predictionmay be triggered by selecting a targeting icon 1402. Upon selection ofthe targeting icon 1402, a target dialog box 1404 may be presented. Thetarget dialog box 1404 may include a prompt of a configuration option1406 for input of a target value. Once the target value (e.g., 8.7) isentered and saved, the GUI 1400 may provide an indication of when thetarget will be met. In some embodiments, the target may include globaltargets and/or personal targets. For example, a global target may be setby an administrator for all users, users of a certain group, and/orother groups that may have a common target. The personal targets may beset using the target dialog box 1404 by a user for himself or herself.

FIG. 15 illustrates a GUI 1500 where a target prediction box 1502 ispresented based upon the target value input in the target dialog box1404 of FIG. 14. In certain embodiments, the target prediction box 1502may include an indication 1504 of the target value input into the targetdialog box 1404, an indication 1506 of a date and/or time when thetarget value is predicted to be met, and an indication 1508 of an actualforecasted value for the date and/or time. The target prediction box1502 may include a pointer 1510 and point 1511 that indicates the timeand/or point on the chart where the target is met. Further, in someembodiments, a target visualization 1512 may be included to provide avisual representation of the previously submitted target value input. Insome embodiments, the target may have been achieved in the historicaldata. The target may be represented in the historical data (e.g., solidline portion) rather than the predicted data (e.g., dashed lineportion).

In some embodiments, notifications may be provided to indicate when thetarget and/or a notification point has been and/or is predicted to bereached. For example, the notifications may include text messages, emailnotifications, automated phone calls, app notifications, and/or othernotification methods that may be suitable for contacting/updating auser. As noted, these notifications may be triggered based upon certaincriteria. For example, GUI 1600 of FIG. 16 presents a notificationdialog box 1602 when triggered by selecting a notification icon 1602. Insome embodiments, notification criteria may be selected from a selectionbox 1606. The selection box 1606 may enable selection of an all-timehigh option 1608, an all-time low option 1610, a less than option 1612,and a more than option 1614. The all-time high option 1608 triggers anotification if the time-series data crosses an all-time high value forthe time-series data. The all-time low option 1610 triggers anotification if the time-series data crosses an all-time low value forthe time-series data. The less than option 1612 triggers a notificationwhen the time-series data falls below a specified lower threshold. Themore than option 1614 triggers a notification when the time-series datacrosses a specified upper threshold. For example, in the GUI 1700 ofFIG. 17, when the more than option 1614 is selected, an additionalprompt 1702 is provided, enabling input of an threshold value (e.g., 14)that may be saved using a save button 1704. Similar to the target, thenotifications may be personal and/or globally set.

In some embodiments, once the notification criteria are set, avisualization of the threshold may be provided. For example, in FIG. 18,a GUI 1800 provides a more than threshold indicator 1802. Additionallyor alternatively, the GUI 1800 could include less than thresholds(personal and/or global), more than thresholds (personal and/or global),all-time high thresholds (personal and/or global), all-time lowthresholds (personal and/or global), targets (personal and/or global),or any combination thereof. Accordingly, each GUI scorecard (e.g., GUI1800) of an indicator may potentially include numerous potential piecesof data with potential multitudes of indicators and potential multitudesof breakdowns for each indicator. For example, the indicators may bebroken down by dimensions of the indicators, priority classification,category of indicator, assignment group to which the indicator isassigned, severity of the indicator, location corresponding to theindicator, or any other suitable breakdowns for analyzing theindicators. Thus, the performance analytics engine may include vastamounts of data that may be divided among multiple different pages thatmay not be readily consumed by users or administrators due to the largenumber (e.g., thousands) of individual pages showing such information.Accordingly, as discussed below, data insights may provide a suitablebrief representation of the most pertinent items (e.g., indicators,breakdowns) and their respective measurements (e.g., targets,notification thresholds, change percentages, etc.).

Data Insights

A data insights widget provides a customer/user a single widget in whichinteresting changes (e.g., thresholds, targets, etc.) in the time-seriesdata may be viewed. In some embodiments, this widget may be generatedand presented without any additional configuration from thecustomer/viewer. The interesting data (“news”) may be presented in“headlines” for the various indicators and their correspondingmeasurements in the data insights widget. In some embodiments, thiswidget and its headlines may be computed periodically. For instance, insome embodiments, the headlines may be computed at the end of each day,weekly, every certain number of hours, and/or any other suitablevariable of time for recomputing the headlines. As appreciated, since alarge amount of data may be recomputed for the data insights widget, thefrequency of recomputation may be balanced against performance drainsdue to the recomputations. As noted below, in some embodiments, theseheadlines may be selected in the widget to open the correspondingscorecard GUI (e.g., GUI 1800). Additionally or alternatively, thewidget may provide headlines that indicate that an indicator hasinteresting data to cause the user/customer to direct their attention tothe indicator type and navigate to the indicator type scorecard GUIthrough the performance analytics interface. In other words, the datainsights widget may enable reviewing of most pertinent informationwithout presenting non-pertinent information. In other words, the datainsights widget removes the haystack from a proverbial needle in ahaystack situation.

FIG. 19 illustrates a GUI 1900 showing a data insights widget 1901. TheGUI 1900 includes a drop down menu 1902 that enables selection of anindicator type/group of indicator types, such as incident managementthat may be used to view/edit corresponding indicator types. Forexample, in the GUI 1900 corresponding to a selection of incidentmanagement in the drop down menu 1902, the GUI 1900 may include a numberof open incidents tab 1904, an incident open tab 1906, and an incidentnew tab 1908. The number of open incidents tab 1904 may be used topresent the data insights widget 1901 for open incidents. The incidentopen tab 1906 may be used to open a specific indicator, such as byopening specific scorecards for an indicator type and/or its sub-groupbreakdowns. The incident new tab 1908 may be used to view new incidentsthat have occurred in a recent (e.g., 5 days, 30 days, etc.) and/or addnew incidents.

Within the number of open incidents tab 1904, a title 1910 is presentedthat indicates what is being viewed in the data insights widget 1901.For example, in the illustrated embodiments, the title 1910 indicatesthat the number of open incidents is being viewed. Furthermore, in theillustrated embodiment, the title 1910 includes a sub-title 1912 thatindicates a breakdown of the indicator corresponding to the title 1910into a category of inquiry/help type incidents. Additionally oralternatively, the breakdown may include groups/individuals to which theincidents are assigned, types of incidents, time periods, user-definedbreakdowns, and/or any other suitable divisions that may be helpful toexamine for the specific indicator type/group being viewed in the datainsights widget 1901. In the breakdown indicated in the sub-title 1912,multiple days may be presented in a timeline 1913 that includes variousdays 1914, 1916, 1918, and 1920. However, in some embodiments, thetimeline 1913 may include different divisions, such as hours or days.Indeed, in certain embodiments, the divisions may be selectable in thedata insights widget 1901. Moreover, although the illustrated timeline1913 includes separate periods (e.g., days) having a similar length, thetimeline 1913 may include varying lengths between periods. For example,the timeline 1913 may include one entry for a current day and anotherentry for a past week. The timeline 1913 may present selection buttons1922 (e.g., radio buttons) that enable selection of entries in thetimeline 1913.

The timeline 1913 may also provide data insights 1924, 1926, 1928, and1930 that are selected based at least in part into most interestingbased on scoring. For example, each insight may include an icon 1932that enables quick identification of a type of insight. For example, theicon 1932 may be a bar graph when a threshold has been reached/ispredicted to be reached, may be a crosshair when a target has beenreached/is predicted to be reached, may be an arrow when atarget/threshold is predicted, and/or other icons that may be used toindicate to what the corresponding insights 1924, 1926, 1928, and 1930correspond. Each insight may also include a score 1934 that indicates ascore for the data insight. For example, the score 1934 may indicate avalue for the corresponding statistic. For instance, when an insight anall-time low/low threshold, the score 1934 may be the actual number forthe threshold that is reached/predicted to be reached. When the insightis a target, the score 1934 may be the difference (total-number-based orpercentage-based) between the target and the current value. In otherwords, the difference may be the number of items (e.g., open records) ora percentage of the target (e.g., 95% of target) that is between thecurrent value and the target. The insights may also include a briefdescription 1936 that explains to what the score 1934 corresponds.

Within the data insights widget 1901, the entries in the timeline 1913may be selected and acted upon. For example, an entry may be selectedusing the buttons 1922 and have a corresponding chart displayed byselecting a show chart button 1938. Similarly, an entry may be selectedusing the buttons 1922 and have a corresponding scorecard (e.g., GUI1800) displayed by selecting a show scorecard button 1940. Furthermore,an entry may be selected using the buttons 1922 and a user may subscribeto the corresponding statistic using a subscribe button 1942.

Whichever entry is selected using the buttons 1922 may cause the datainsights widget 1901 to display additional insights 1944, 1946, and 1948for the selected entry in the timeline 1913. The additional insights1944, 1946, and 1948 may provide additional information about thebreakdown and/or insight type for the selected entry. The insights 1944,1946, and 1948 may each include a title 1950 indicating a type ofinsight. As discussed below, the insight types of the insights 1944,1946, and 1948 may include a different type than those shown in theinsights 1924, 1926, 1928, and 1930. For example, the insights 1924,1926, 1928, and 1930 may include simple analysis, such as targets andthresholds whether predicted or measured. In some embodiments, theinsights 1924, 1926, 1928, and 1930 may be those that pass a specificnewsworthiness threshold. For example, the predicted occurrence may beless than a threshold number of days from a current day. Additionally oralternatively, the newsworthiness threshold may be that the data hasreached an all-time high/low that is higher/lower than any other valuesin the past threshold number of days. The insights 1944, 1946, and 1948may include more in-depth analysis, such as volatility, lows/highs overa specified period, whether data is an outlier/abnormal score, or othersecond-order analysis.

The insights 1944, 1946, and 1948 may also include a description 1952that indicates an indicator type and/or its breakdown for the insight.The insights 1944, 1946, and 1948 may also include a time indicator 1954that indicates a time period over which the corresponding insightrefers.

FIG. 20 provides a GUI 2000 that provides an alternative embodiment ofthe data insights widget 1901 in a data insights widget 2001. Asillustrated, the data insights widget 2001 is similar to the datainsights widget 1901 with a different arrangement of information. Forinstance, the data insights widget 2001 includes the drop down menu 1902that enables selection of an indicator type/group of indicator types,such as incident management that may be used to view/edit correspondingindicator types. Also similar to the data insights widget 1901, the datainsights widget 2001 includes the number of open incidents tab 1904, theincident open tab 1906, and the incident new tab 1908 with the number ofopen incidents tab 1904 including data insights 2002, 2004, 2006, and2008. The data insights 2002, 2004, 2006, and 2008 includes the title1950 and the corresponding score 1934. The data insights 2002, 2004,2006, and 2008 also respectively include sub-titles 2010, 2012, 2014,and 2016 that provide additional details about the respective datainsights 2002, 2004, 2006, and 2008. As illustrated in the data insightswidget 2001, at least one insight may include additional details thatare not included for other insights. For example, the data insight 2002includes a graph 2020, a target 2022, and a difference 2024. In someembodiments, these additional details may be invoked using the showchart button 1938 of GUI 1900 of FIG. 19. In some embodiments, the graph2020 may illustrate historical data and/or predicted data correspondingto the title 1950 and the sub-title 2010. The target 2022 may display aglobal and/or personal targets or thresholds for the indicator group orbreakdown corresponding to the sub-title 2010.

FIG. 21 is a flow diagram of a process 2100 for implementing the datainsights widget 2001. The platform 104 may wait until a time torecalculate has been reached (block 2102). For example, data may beretrieved for one or more instances running on the platform periodicallyand/or in response to manual invocation of the retrieval. For instance,the period may include day(s), week(s), and hour(s). Moreover, theperiod may include a time (e.g., overnight) where a load on the platformmay be expected to be small. Furthermore, in some embodiments, theplatform 104 may determine whether the instance 130 and/or the platform104 are experiencing a relatively heavy load before retrieving the data.In such embodiments, when the instance 130 and/or the platform 104 areexperiencing a relatively heavy load, the platform 104 may delayretrieval until the load has lessened. Additionally or alternatively,the platform 104 may utilize the retrieval when a relatively low load isexperienced on the instance 130 and/or the platform 104.

Once the data is retrieved, the platform 104 determines a score for eachindicator type/metric tracked in the data is used to generate a newsscore (block 2104). As noted below and above, the scores may include araw number (e.g., number of open incidents) of the indicator/metric, agenerated value generated from the raw number using a transfer functionfor the indicator/metric, a weighting of the raw number/generated value,and/or other computations that may be used to rate “newsworthiness” ofdata corresponding to the indicator/metric. The indicators/metrics arethen organized based at least in part on their scores (block 2106). Forexample, data entries for each indicator/metric may be stored in a newsscore database in an ascending or descending order of news scores. Atleast a portion of the indicators/metrics are selected by the platformbased at least in part on their news scores (block 2108). For example, amaximum number of displayed items may be less than the number ofindicators/metrics in the portion. Additionally or alternatively, athreshold score may be used to filter out indicators/metrics from thedata insights widget if their news score is below the threshold. Theselected indicators/metrics are displayed in a data insights widgetwithout displaying other portions of the data (block 2110).

FIG. 22 is a flow diagram of a process 2200 for implementing the datainsights widget 2001. For example, the process 2200 may be performed bythe platform 104, where the platform 104 utilizes one or more serversremote from multiple client networks to manage the multiple clientnetworks (e.g., network 112). In some embodiments, the platform (e.g.,an enterprise management platform) hosts a respective instance (e.g.,instance 130) for each of the multiple client networks. The platform 104may be configured to receive incoming data (block 2202). The incomingdata includes one or more metrics or indicators being tracked in theincoming data by the platform 104. The platform 104 determines that acondition is reached based on the one or more metrics (block 2204). Forexample, the condition may include a threshold (predicted or previouslyoccurring), a target (predicted or previously occurring), a news score(as discussed below), a user-defined condition, and/or any otherconditions that may be tracked for the metrics/indicators.

Responsive to determining that the incoming data is indicative of thecondition being reached, the platform 104 selects at least a portion ofthe incoming data for a dashboard display (block 2206). For example, thedashboard may display one or more widgets, such as a data insightswidget that includes the at least a portion of the incoming data. Theplatform 104 provides a graphical user interface (GUI) to a clientdevice (e.g., the client 102) associated with one of the multiple clientnetworks (block 2208). For example, the representation of the GUIincludes a data insights widget of the dashboard that displays the dataindicative of the condition being reached without displaying other datain the incoming data that has not reached a level indicative of otherconditions.

Dynamic Analytics

As previously noted, the data insights may include targets andthresholds that are ordered based at least in part on their score.However, dynamic insights may be generated for analytics types otherthan targets and/or thresholds to provide additional insights to enablea user to quickly view changes and/or important events without drillingdown and analyzing potentially massive amounts of data manually.Furthermore, these second-tier analytics may include dynamic analysisthat is context-driven to provide visibility of changes (e.g., negativemovement) for certain breakdowns (e.g., assignment group) of anindicator type (e.g., open incident reports). For instance, thesesecond-tier analytics may provide scoring relative to the specific typeof analytics performed for a specific indicator type.

FIG. 23 is a block diagram of a dynamic analytics engine 2300 that maybe used to combine various analytic types for the data insights widget1901, 2001. As illustrated, the dynamic analytics engine 2300 receivestime-series data 2302. For example, the time-series data 2302 mayinclude any data corresponding to one or more indicator types that aretracked by/for the system 100, such as a number of incident reportsopen. The time-series data 2302 may be pulled periodically by thedynamic analytics engine 2300. For example, the dynamic analytics engine2300 may pull the time-series data 2302 during expected low levels ofuse (e.g., overnight). Additionally or alternatively, in someembodiments, the dynamic analytics engine 2300 may pull the time-seriesdata 2302 in response to a demand requesting generation of new headlinesin the data insights widget 1901, 2001.

The dynamic analytics engine 2300 includes a statistics engine 2304 thatgenerates statistics for one or more indicator types. As discussedbelow, the statistics engine 2304 may utilize one or more tables todefine specific statistics that may be measured and/or tracked in thesystem 100. For instance, the statistics may track a relative size ofchange, an amount of change, how long since some occurrence, a variance,an interquartile range, a frequency of permutations of up/down movementsover recent time periods, a start or end of a trend in the data, howfrequently a target/threshold has been crossed, a change in when apredicted target/threshold crossing is to occur since a period of time(e.g., from previous day to current day), and/or any other statisticsthat may be used to examine the breakdowns and/or the indicators. Therelative size may be decided by diving a size of a last change by aninterquartile range to decide if the last change was relatively large.One or more statistics 2306 are passed from the statistics engine 2304to a score generator 2308. The score generator 2308 normalizes scoresfor each statistic such that scores for different statistics using a setof rules that may be pre-set and/or dynamically assigned by auser/administrator for the system 100. These scores are passed to aninsight sorter 2310 that sorts the insights according to the scores fromthe score generator 2308. In some embodiments, the target and/orthreshold insights 2312 may be passed directly to the insight sorter2310 with their scores (relative to percentage or overall total values).In some embodiments, scores for the target and/or threshold insights2312 may be derived from the time-series data 2302 using the scoregenerator 2308 and/or respective rules to have the scores for the targetand/or threshold insights 2312 computed. A headline deriver 2314 thenselects insights having high enough scores as headline insights 2316that are to be presented in the data insights widget 1901, 2001.

In some embodiments, the statistics engine 2304, the score generator2308, and/or the headline deriver 2314 may utilize one or more databasesto generate the headline insights. FIG. 24 illustrates an exampleembodiment of databases 2400 that may be used in the statistics engine2304, the score generator 2308, and/or the headline deriver 2314. Thedatabases 2400 include a rules database 2402, a relationship database2404, a statistic generators database 2406, a statistic configurationsdatabase 2408, and a news items database 2410. The rules database 2402includes definitions of different types of news that may be generated.The relationship database 2404 provides mapping relationship betweenrules in the rules database 2402 and statistic generators in thestatistic generators database 2406. The statistic generators database2406 includes definitions of different types of statistics that may beused in the score generation. The statistic configurations database 2408stores configuration settings for the statistic generators in thestatistic generator database 2406. The news items database 2410 storesnews items (e.g., the headline insights 2316). In some embodiments, thenews items may be stored for a predetermined period of time, such as anumber (e.g., 2) weeks or months.

FIG. 25 illustrates a GUI 2500 that may be used to add/view/changeentries 2502 in the rules database 2402. The entries 2502 may include arespective entry for each rule. These respective rules may be identifiedusing respective names 2504, 2506, 2508, and 2510 that identify theunderlying rules, respectively. The names 2504, 2506, 2508, and 2510 mayalso correspond to respective descriptions 2512, 2514, 2516, and 2518that each describes the corresponding rule in more detail that the names2504, 2506, 2508, and 2510. For example, the entries 2502 include a rulefor alerting for a new high value for the indicator type, a rule foralerting for a new low value for the indicator type, a rule for alertingfor data points that are anomalous outliers, a rule for alerting forchanges in short term turbulence/volatility of an indicatory, and/orother suitable data tracking/analysis mechanisms. Each entry may alsoinclude an active flag 2520 that may be set to one value (e.g., trueor 1) when the rule is to be used and another value (e.g., false or 0)when the rule is not to be used in deriving news from the time-seriesdata 2302. The GUI 2500 may also be used to view/change a news frequencysetting 2522. The news frequency setting 2522 is how many multiples of aperiod of time (e.g., days, weeks, etc.) before a user gets a news itemfor a rule of a same or lower level of importance after a prior newsitem for the rule and indicator/breakdown has been shown. In otherwords, the news frequency setting 2522 sets how long a “snooze” occursafter a rule has generated a news item before it is shown again withouta change in scoring (e.g., worsening) of the condition. The importanceof the rule may be set dynamically in the GUI 2500 using a ruleimportance field 2524. In the illustrated embodiment, the ruleimportance setting 2524 may be populated with a value between a firstvalue (e.g., 0) and a second value (e.g., 1) that provides news scoreweighting when sorting the corresponding rules. In some embodiments, theweighting and/or dynamic enablement of the rules may also be applied tovisibility of thresholds and/or targets in the data insights widget1901, 2001.

The relationship database 2404 may include the name (e.g., name 2504) ofa rule in the rules database 2402 and maps the entry to a statisticgenerator entry in the statistic generators database 2406 and/or thestatistic configurations database 2408. The rule may have itsrelationship, statistic generator(s), and its configurations set using aGUI, such as the GUI 2600 of FIG. 26. The GUI 2600 may display/enableediting of the name 2504 and the description 2512 of the GUI 2500 ofFIG. 25. Furthermore, the GUI 2600 may include an active button 2602that may be used to flag whether the rule is currently active forgenerating insights in the data insights widget 1901, 2001. This changewill toggle the active flag 2520 of the corresponding rule in the GUI2500 of FIG. 25. The GUI 2600 may also include a class name 2604 thatmay be used to classify the rule in a class of rules. A rule importancefield 2606 may be used to view/change the rule importance field 2524 ofthe GUI 2500 of FIG. 25. Similarly, a news frequency field 2608 may beused to view/change the news frequency setting 2522 of the GUI 2500 ofFIG. 25. The GUI 2600 may also include an update button 2610 to save anychanges to the name 2504, the description 2512, the active button 2602,the class name 2604, the rule importance field, and/or the newsfrequency field 2608.

The GUI 2600 may also include a statistic generator table 2612 thatincludes statistic generator entries 2614. For example, for the rule“New High,” the entries 2614 include a days since higher statisticgenerator 2616 that tracks a length of time since a previous highervalue has occurred. The “New High” rule also includes a change magnitudestatistic generator 2618 that indicates how much a value of theindicator for the rule has changed in magnitude from a previous high.New statistic generators may be created using a new statistic generatorbutton 2620. Similarly, a currently selected entry 2614 may be editedusing an edit button 2622.

Since a rule may potentially have numerous associated statisticgenerators associated therewith, the GUI 2600 may include a search bar2624 to enable searching the entries 2614 to find a specific entry.Furthermore, the GUI 2600 may include a navigation bar 2626 to navigatethrough the potentially large number of entries 2614. Any changes may besaved using the update button 2610 and stored in the statistic generatordatabase 2406.

When the new statistic generator button 2620 is selected or the editbutton 2622 is selected a statistic generation GUI may be presented. Forexample, FIG. 27 illustrates a GUI 2700 that may be used to configure astatistic generator entry, such as the days since higher statisticgenerator 2616 of FIG. 26. As illustrated, the GUI 2700 includes a namefield 2702 that may be used to name the statistic generator and adescription field 2703 that provides a brief description of thestatistic generator. The GUI 2700 may also be used to define at whatlevel the statistic is to be generated. For instance, the GUI 2700 mayinclude an element level statistic button 2704 that may be used to setwhether the statistic is to be calculated at a breakdown level.Similarly, the GUI 2700 may include an indicator level statistic button2706 that may be used to set whether the statistic is to be calculatedat the indicator level. In other words, in the illustrated GUI 2700,days since higher statistic may be generated for breakdowns andindicators due to the selection of the element level statistic button2704 and the indicator level statistic button 2706. The GUI 2700 mayalso include a statistic generator function name 2708 that indicates afunction name for the statistic. The GUI 2700 may include an updatebutton 2710 that may be used to update the statistic generator with anychanges in the GUI 2700.

The GUI 2700 includes a configuration table 2712 that includes entries2714. The entries 2714 include a days of scores column 2716. The days ofscores column 2716 indicates a days of scores to be captured before thestatistic generator may be used to generate a statistic. The entries2714 also includes a filter threshold 2718 below which the statisticgets filtered out of the insights in the data insights widget 1901,2001.

FIG. 28 is a flow diagram of a process 2800 that may be used ingenerating news items/data insights for the data insights widget 1901,2001. The process 2800 may be at least partially performed in the client102 and/or the platform 104. The process 2800 includes receivingtime-series data (block 2802). Receiving the time-series data mayinclude retrieving the time-series data from the databases 108periodically (e.g., hourly, nightly, weekly, etc.) and/or in response toa manual request to start acquiring data, such as a manual request toupdate the data insights widget 1901, 2001.

Upon receiving the time-series data, the process 2800 continues with adetermination whether an indicator in the time-series data has anyassociated statistics (block 2804). For example, determining whether theindicator has an associated statistic may include determining whetherany statistic generators flagged as indicator level in the GUI 2700. Ifone or more statistic generators are enabled for the indicator, theplatform 104 may determine whether the one or more statistic generatorsare to be processed (block 2806). For example, the determination mayinclude determining whether the one or more statistic generators areflagged as active in the GUI 2600. For each active and associatedstatistic generator, a statistic is generated using the correspondingstatistic generator (block 2808).

Once the indicator level statistics are generated, statistics may begenerated for each designated breakdown of the indicator. The platform104 determines whether one or more statistic generators are associatedwith at least one breakdown (block 2810). For each statistic to begenerated for each breakdown (block 2812), a corresponding statisticgenerator may be used to generate the statistic (block 2814). Once theplatform 104 has consumed all of the active statistic generators togenerate all of the active statistics for the indicator and itsbreakdowns, the platform 104 determines whether statistics for otherindicators are to be generated (block 2816). If more indicators are tobe evaluated, the process 2800 returns to block 2804.

The platform 104 then generates a score for each statistic using thecorresponding rule (block 2818). For instance, the rule may includeweighting used to weight the computation and/or other conversions togenerate a news score for the statistic. In other words, the platform104 enables users/administrators to identify some news item rules,indicator types, and/or breakdowns as important news that may beprioritized and viewed in the data insights widget 1901, 2001 beforeother, less important news items. In other words, theusers/administrators may use the platform 104 to flag certain rules,indicator types, and/or breakdowns as key aspects. Additionally oralternatively, the platform 104 may generate the score by using atransfer function to convert a score (e.g., raw number) for thestatistic to the news score. For example, the news score may be based ona degree of change relative to changes in the statistic within thewindow being analyzed, such as dividing the most recent change by aninterquartile range to determine the relative degree of change.

The generated news scores may then be filtered to remove duplicate itemsthat have been displayed within a news frequency (block 2819). Forexample, as previously discussed, the news frequency may be set in theGUI 2600. Furthermore, in some embodiments, the news items may befiltered for duplicate news items within the news frequency for the sametype and same (or lower) news score. Moreover, in certain embodiments,the duplicate items may be removed before storage in the news itemsdatabase 2410, after storage in the news items database 2410, beforereceiving a request to display news items, and/or after receiving arequest to display news items.

The platform 104 stores the news scores in the news items database 2410(block 2820). In some embodiments, the platform 104 may sort the newsitems before or after storage in the news items database 2410. Forexample, the news items may be sorted from low-to-high or high-to-low inthe news items database 2410.

The client 102 and/or servers in the platform 104 may utilize the newsitems in the news items database 2410. For example, the client 102and/or servers in the platform 104 may utilize a process 2900 asillustrated in the FIG. 29. The process 2900 begins with receiving arequest (block 2902). For example, an application programming interface(API) may be called by the data insights widget 1901, 2001 to access thenews items database 2410 to display news items/data insights in the datainsights widget 1901, 2001. In some embodiments, the request may includean identifier for an indicator and/or a breakdown being viewed in thedata insights widget 1901, 2001. Additionally or alternatively, therequest may include a date to be viewed. For example, the indicator, thebreakdown, and/or date may include a date selected in the GUI 1900.

In response to the request, the client 102 and/or servers in theplatform 104 fetches news from the news items database 2410 (block2904). In some embodiments, the client 102 and/or servers in theplatform 104 fetches a number of news items that are viewable in thedata insight widget 1901, 2001. In some embodiments, the client 102and/or servers in the platform 104 may fetch between a maximum plus abuffer to ensure that some filtration of the news items may stillpopulate the data insights widget 1901, 2001. Additionally oralternatively, the client 102 and/or servers in the platform 104 mayfetch all news items above a threshold news score to ensure that anypotential news items are fetched even if not all fetched news items areviewable in the data insights widget 1901, 2001.

The client 102 and/or servers in the platform 104 may then send aresponse to the request with the at least one news item where the atleast one news item includes the fetched and filtered news items (block2908). For example, the response may be an API response to the datainsights widget 1901, 2001 that includes the fetched and filtered newsitems along with scores, additional data, and/or links to additionaldata about the statistics. In response to some requests, the database2410 may include no news items and the response would include no newsitems. Thus, an empty or null response may be sent to the requestingdevice. Upon receiving the statistic, the data insights widget 1901,2001 displays the at least one the news items (block 2910). In someembodiments, the response includes one or more news items that are notdisplayed in the data insights widget 1901, 2001. In some embodiments,the number of news items returned (and displayed) may vary betweendifferent requests. For example, on a first day, a request may cause areturn of 3 news items, but on a second day, a request may cause areturn of a single news item. However, some days as noted above, therequest may return no news items and the data insights widget 1901, 2001may display no news items.

As previously noted, the news items/data insights for a specific date ordate(s) may be pulled using an API, such as a performance analytics API.For example, all news items/data insights may be fetched for a specificUUID for an indicator and/or breakdown for the indicated dates or date.In some embodiments, the date may be omitted from the API request and acurrent date may be used for the fetch. The API may be viewed, edited,and/or called using an API explorer. FIG. 30 illustrates a GUI 3000 foran API explorer that may be used to view/edit/call the API in therequest of FIG. 29. The GUI 3000 includes a namespace field 3002, an APIname 3004, and an API version field 3006. The namespace field 3002indicates what group of types, functions, and variables are accessed inthe API explorer through the GUI 3000. The API name 3004 indicates anAPI being viewed, edited, and/or called in the GUI 3000. For example,the illustrated API name 3004 in the GUI 3000 indicates that aperformance analytics insights API is being accessed. The API versionfield 3006 indicates a version for the API indicated in the API name3004. For example, in the illustrated embodiment, a current version ofthe API is being viewed, edited, and/or called.

The GUI 3000 also includes a description 3008 of one or more functionsof the API being viewed and/or edited. In some embodiments, more thanone function may be listed and the function may be selected to view,edit, and/or call the corresponding function of the API. The GUI 3000also includes a prepare request region 3010 that enables editing of arequest to the API. The prepare region 3010 includes a path parameter3011 that indicates a path for the indicator and/or breakdown for whichnews insights are to be pulled. The path parameter 3011 may include alabel 3012 for the path. For example, the label 3012 indicates that thepath parameters includes a UUID. In some embodiments, the pathcorresponding the label may be required for completing the API request.Accordingly, in some embodiments, the label 3014 may have a mark 3016that indicates that a corresponding value 3018 for the label 3014 isrequired for the request. For example, in the illustrated embodiment,the GUI requires that a UUID is required before the request isgenerated.

The GUI 3000 also includes a query parameter 3020 that may indicateparameters of the query in the request. The query parameters 3020 mayinclude a name field 3022 and a value field 3024. The name field 3022indicates a name of the parameter. For instance, in the illustratedembodiment, the name field 3022 includes a “sysparm_date” that indicatesthat the query parameter 3020 includes a date used for the request. Thevalue field 3024 may indicate a value for the parameter type indicatedin the name field 3022. For example, in the illustrated embodiment, thevalue field 3024 indicates a date (Jan. 26, 2018) for the request usedto determine news insights for the indicated date. In some embodiments,news items/data insights may be fetched from the news items database2410 for dates as far back as stored in the news items database 2410.

The GUI 3000 may include an add parameter button 3026. Upon selection ofthe add parameter button 3026, the GUI 3000 may be used to add a newparameter for the query. In some embodiments, the search may beindependent to include any results that satisfy any parameter or may becumulative such that returned/fetched results satisfy all parameters.The GUI 3000 may include a remove parameter button 3028 that works toremove parameters like the add parameter button 3026 is used to addparameters to the query for the API request.

FIG. 31 illustrates a process 3100. The process 3100 may be at leastpartially executed by the platform 104. As previously noted, theplatform 104 includes the database 108 and may host one or moreinstances. The database 108 may include one or more news scores eachcorresponding to one or more indicator types (e.g., number of openincidents). Each of the one or more news scores is based at least inpart on a metric of the corresponding one or more indicator types. Theplatform 104 utilizes a news statistic collector to receive periodicdata from a collector job that collects the periodic data (block 3102).The periodic data includes the metrics of the corresponding one or moreindicator types for a period corresponding to the periodic data. Theplatform also uses the news stats collector to, for each indicator type,apply a statistic generator to generate analytical statistics toevaluate the periodic data (block 3104) and for each of the analyticalstatistics, filter the periodic data based at least in part on a newsscore threshold (block 3106). The platform 104 may also use a newsevaluator to evaluate each of the analytical statistics to generate theone or more news scores (block 3108) and to store the one or more newsscores to the database 108 (block 3110).

The platform 104 may also be used to generate insights using an insightgenerator. The insight generator of the platform 104 receives a requestfor a data insight for the one or more indicator types (block 3112). Forexample, the insight generator may receive a request from an applicationprogramming interface (API) requesting data insights for the datainsights widget for the period. In response to the request, the insightgenerator fetches the analytical statistics from the database 108 withcorresponding one or more news scores (block 3114). The insightgenerator then determines news items from the periodic data based atleast in part on the one or more news scores in the fetched analyticalstatistics (block 3116). The insight generator also provides, to aclient device (e.g., client 102) associated with the one or moreinstances (e.g., instance 130), a representation of a graphical userinterface (GUI) that displays a data insights widget (block 3118). Thedata insights widget presents summaries of the news items based at leastin part on corresponding news scores of the one or more news scores.Providing the GUI may include rendering at least a portion of the GUI onone or more servers of the platform 104 before transport to the clientdevice and/or rendering at least a portion of the GUI on the clientdevice based on data from the one or more servers of the platform 104.

In some embodiments, the news collector, the statistics generator, thenews evaluator, and/or the insight generator may be application functionblocks that include instructions stored in memory that may be called byprocessor(s) of one or more servers in the platform 104.

The techniques presented and claimed herein are referenced and appliedto material objects and concrete examples of a practical nature thatdemonstrably improve the present technical field and, as such, are notabstract, intangible or purely theoretical. Further, if any claimsappended to the end of this specification contain one or more elementsdesignated as “means for [perform]ing [a function] . . . ” or “step for[perform]ing [a function] . . . ”, it is intended that such elements areto be interpreted under 35 U.S.C. 112(f). However, for any claimscontaining elements designated in any other manner, it is intended thatsuch elements are not to be interpreted under 35 U.S.C. 112(f).

What is claimed is:
 1. A system, comprising: a database disposed withina remote management platform hosting one or more instances, wherein thedatabase comprises one or more news scores each corresponding to one ormore indicator types, wherein each of the one or more news scores isbased at least in part on a metric of the corresponding one or moreindicator types; a news statistic collector configured to: receiveperiodic data from a collector job that collects the periodic datacomprising the metrics of the corresponding one or more indicator typesfor a period corresponding to the periodic data; for each indicatortype, apply a statistic generator to generate analytical statistics toevaluate the periodic data; and for each of the analytical statistics,filter the periodic data based at least in part on a news scorethreshold; a news evaluator configured to: evaluate each of theanalytical statistics to generate the one or more news scores; and storethe one or more news scores to the database; and an insight generatorthat is configured to: receive a request for a data insight for the oneor more indicator types; in response to the request, fetch theanalytical statistics from the database with corresponding one or morenews scores; determine news items from the periodic data based at leastin part on the one or more news scores in the fetched analyticalstatistics; and provide, to a client device associated with the one ormore instances, a representation of a graphical user interface thatdisplays a data insights widget, wherein the data insights widgetpresents summaries of the news items based at least in part oncorresponding news scores of the one or more news scores.
 2. The systemof claim 1, wherein the period comprises a day, and periodicallyreceiving the periodic data comprises daily receiving the periodic datafor a previous day.
 3. The system of claim 1, wherein the periodic datacomprises time-series data for the metrics for the period.
 4. The systemof claim 1, wherein the news score threshold comprises a news scorethreshold for each metric of the corresponding one or more indicatortypes.
 5. The system of claim 1, wherein data insights widget isconfigured to display the summaries of the news items in an order sortedby the corresponding news scores.
 6. The system of claim 1, whereinreceiving the request comprises receiving an application programminginterface (API) request indicating that the data insight is to bedisplayed.
 7. The system of claim 6, wherein the API request comprises adate used to determine which statistics are to be fetched from thedatabase.
 8. The system of claim 6, wherein the API request comprisesuniversally unique identifier (UUID) that indicates a selected indicatortype of the one or more the indicator types.
 9. The system of claim 8,wherein the selected indicator type comprises a number of open incidentshave not been resolved for an information technology operationsmanagement (ITOM) application program.
 10. The system of claim 8,wherein the selected indicator type comprises a user-defined aspect tobe tracked by the system.
 11. The system of claim 1, wherein the insightgenerator is configured to filter the news scores for positive changesonly or negative changes only before determining news items.
 12. Thesystem of claim 1, wherein the insight generator is configured to removeduplicate news items before providing the news items to the datainsights widget.
 13. The system of claim 12, wherein duplicate newsitems are news items of a common type that occur within a news frequencysetting corresponding to the common type.
 14. A method comprising:receiving time-series data at an enterprise management platform, whereinthe enterprise management platform is configured to host a respectiveinstance for each of a plurality of client networks, and the time-seriesdata comprises one or more metrics being tracked by the enterprisemanagement platform; for each metric of the one or more metrics,determining that a statistic generator is to be processed for thecorresponding metric; responsive to determining that the statisticgenerator is to be processed, generating a statistic using the statisticgenerator; for each statistic, generating a news score, using a newsevaluator, to convert the statistic generator to a news score; sortingthe news scores; and storing the news scores in a database disposedwithin the enterprise management platform.
 15. The method of claim 14,wherein receiving the time-series data is performed periodically. 16.The method of claim 14, wherein generating the news score comprisesusing a transfer function to convert the news score to the news score orusing the statistic as the news score.
 17. The method of claim 14,wherein the one or more metrics correspond to an indicator type or abreakdown of the indicator type.
 18. A method comprising: receiving arequest for news items at an enterprise management platform, wherein theenterprise management platform is configured to host a respectiveinstance for each of a plurality of client networks, and the news itemscorrespond to news scores for one or more metrics being tracked by theenterprise management platform; fetching news items from a databasedisposed within the enterprise management platform, wherein the databasecomprises the news scores each corresponding to and based on the one ormore metrics; removing duplicate news items of a common metric typewithin a news frequency window; and providing, to a client deviceassociated with the respective instance, a representation of a graphicaluser interface that displays a data insights widget, wherein the datainsights widget presents summaries of the news items based at least inpart on corresponding news scores.
 19. The method of claim 18, whereinreceiving the request comprises receiving an application programminginterface (API) request indicating that the data insights widget is tobe displayed.
 20. The method of claim 18, wherein providing therepresentation comprises rendering the data insights widget in theenterprise management platform remote from the client device to displaythe data insights widget at the client device.